Network Security Engineer (Network Security)

Location: Hybrid — onsite and telework in San Antonio, Texas; work must be performed within the United States unless TXCC grants prior written approval.

Company

hirify.global supports cybersecurity operations for Texas Cyber Command (TXCC), including statewide security monitoring and SOC infrastructure.

What you will do

• Engineer, maintain, and tune SIEM platforms including Google SecOps and Gravwell, covering correlation rules, dashboards, enrichment logic, and detection content.
• Configure and optimize IDS/IPS platforms including Cisco Firepower, TippingPoint, and Corelight; develop signatures and reduce false positives.
• Analyze packet captures and network traffic with Corelight, NetWitness, and CRIBL pipelines to validate alerts, detect malicious activity, anomalies, lateral movement, and command-and-control behavior.
• Operationalize threat intelligence by converting indicators and adversary TTPs into SIEM rules, IPS signatures, detection logic, and automated enrichment workflows.
• Build and maintain Cyware orchestration playbooks integrating SIEM, EDR, threat intelligence, and Jira ticketing; support log onboarding, data normalization, sensors, collectors, and log pipelines.
• Provide network-level evidence and threat validation to incident responders, and produce tuning reports, engineering documentation, platform health assessments, and detection coverage maps.

Requirements

• U.S. citizenship and successful completion of required background checks are mandatory.
• At least 5 years of SOC operations experience and threat intelligence application expertise.
• At least 5 years of hands-on experience with Cisco Firepower and TippingPoint IDS/IPS platforms, including signature tuning, false-positive reduction, and threat-driven detection improvements.
• At least 5 years of advanced packet capture and network analysis experience using Corelight, NetWitness, and CRIBL pipelines to identify anomalies, malicious traffic, and lateral movement.
• At least 5 years of experience maintaining and tuning EDR platforms, including CrowdStrike Falcon and SentinelOne, and integrating EDR telemetry into SIEM and orchestration workflows.
• Experience developing detection logic aligned with adversary TTPs, MITRE ATT&CK, threat intelligence, and emerging adversary behavior.
• Required cybersecurity, privacy, and operational training must be completed before system access.
• Compliance with TXCC security and data-handling requirements is required.

Nice to have

• Experience operationalizing intelligence from Recorded Future, ThreatMon, GreyNoise, Google Threat Intelligence, VirusTotal, and Mandiant into SIEM rules, IPS signatures, and automated enrichment logic.
• At least 5 years of packet-level analysis experience validating alerts and identifying malicious activity.
• Experience supporting SOC analysts and incident responders with enriched network-level intelligence.
• Proficiency with Google SecOps and Cyware SOAR, including automated workflows integrating SIEM, IDS/IPS, EDR, threat intelligence, and Jira.
• Security certifications such as CISSP, CEH, GISF, GSEC, CySA+, or Security+.

Culture & Benefits

• Hybrid work arrangement combining onsite work and telework.
• Occasional after-hours support may be required with TXCC approval.
• Work is focused on statewide monitoring expansion, detection coverage, and rapid incident handling.

Hiring process

• Three professional references are required, including each reference’s name, company, and phone number with area code.
• Title, email address, and professional relationship may be provided optionally for each reference.